Transcripts For CSPAN3 Politics Public Policy Today 20150324

Just a suggestion. [ inaudible ] thank you. We have a hurricane thats usually later in the year but point taken. I want to start briefly by talking little bit about the administration the obama administrations work in this area. And, you know, a lot of this goes straight to the top here. President obama upon taking office said Cyber Threats were one of the most serious Economic National Security challenges we face as the nation. And he made confronting them a priority from the beginning of the administration. Hes renewed that pledge several times with each action taken moving this issue forward in the public consciousness. In particular most recently at the white house Cyber Security summit last month at Stanford University where the president once again renewed his commitment to keep combatting Cyber Threats as the top priority. Let me just recount things that happened locke the way too so people have understanding where we are and where we have ended up on policy issues. Four years ago the administration promoted legislation in this area. Several areas including standards for Critical Infrastructure reforming Government Agency security standards, new hiring authority for the department of Homeland Security allowing them more authority in the space information sharing and Liability Protection for information sharing and data breech. National data breech notification standards. Two years ago it became clear congress would not be acting in these areas as quickly as anyone would want. Last year they did pass two of these provisions in particular. And we were pleased to have that move forward. But two years ago when it was clear that information sharing and the moving forward on standards for Critical Infrastructure were not moving as fast as anyone would like, the the president signed an executive order to promote cybersecurity standards for Critical Infrastructure. This had two pieces to it. One was effort to share more information from the federal government to businesses. The second was the creation of the voluntary private sectorled Cybersecurity Framework which nist was convening at the time. National institute of standards and technology. The Cyber Security framework has really been the key to the success of this effort and work of groups like u. S. Telecom and members and other trade associations and companies and the other stakeholders have really led for the framework to become a truly successful document in terms of creating voluntary a voluntary framework that can be used in this space by boards and by executives to make decisions on Cyber Security. And i think at the Cyber Security summit we really heard about the success of that effort and how it is started starting to really change the consciousness of the u. S. Industry and organizations around the world even. And i think the best analogy ive heard the framework came from was someone who said that the Cyber Security framework is the rosettea stone for Cyber Security. And that is what it was intended to be. Mirroring up all the sets of standards that have been done over the years and making them so that we can read them across Critical Infrastructures. And make sure we have coverage and moving forward. And i thats where we ended up and its due to the leadership of groups like u. S. Telecom. So we really appreciate that effort and were making some Real Progress towards having a better set of understanding of where we need to get to and where growth needs to happen because of that effort. Another space that the administration has spent a lot of time and effort is in Incident Response. Weve heard from stakeholders we need to do a better job, that the government needs to participate better and we need to give the tools for industry to be able to respond to threats. Weve continued to work with many sectors in the space, in particular Financial Sector has worked very closely in terms of coming up with ways to respond better to new threats. And we continue to move those efforts forward. But one other area announced last month was is the Cyber Threat Intelligence integration center. And a lot of discussion has gone on about how that relates to the information sharing. I think for the government it relates to information sharing but i think a good way for industry to think is how it relates to Incident Response. Because there is not going to be a public face between industry and the Cyber Threat Intelligence integration center. It is going to be much more of a it is the way that government is going to pull its information together. Pull the intelligence together that already exists out there. This new center is not creating new is not gathering new intelligence. It is pooling all the intelligence together. Taking the analysis out there and integrating it in a way very quickly so then it can be shared back out with stakeholders and that information can be used better. So this is about responding to threats, responding to incidents in ways that can happen much more quickly. The interface with industry rewill remain the same. Working with dhs or the ncic or the service, the Treasury Department or the fbi when there is an incident or working with other sectorspecific agencies that will those will continue to be the face for the incidents. But in terms of the integration, now well have a place where that can happen much more quickly than it has and does today. Next on information sharing. Efforts that have happened in this space. Again, weve been promoting the idea of moving forward legislation in this space. But while that is happening, we continue to take make efforts to get more information sharing from the government to the private sector. As i said the executive order two years ago did. Among private sector entities. And from the private sector to the government. We continue to work in all of those areas. And try to move those efforts more quickly than we have in the past. For example we have beyond the executive order, after the executive order from two years ago was signed where we changed the default from sharing to say the default should be to share unqualified information and to make more information and to declassify more information to make sure that it is shared with the private sector and move in that direction. I think that in my discussions with the private sector i think they have seen a marked increase in the type of information they are getting from the government and the amount of information. So i think were making headway in that area. Also in terms of the private to private sharing weve seen everetts sefforts as well. The anti trusts. The department of the justice and the federal trade commission have now put out guidance saying that if you have are sharing legitimate Cyber Security threat information that that information that there should be no real barrier to antitrust. I mean from antitrust concerns. So we are and weve seen heard of sectors now being able to share among each other in ways that they could not in the past because that concern has been taken off the table. Number two. Weve seen from the department of justice that they have published guidance on sharing information in the aggregate and making sure that that does not run into barriers from the Electronic Communications privacy act. We think that has been helpful for companies to be able to understand what information they can share pretty clearly today and where there are issues. Also at the Cyber Security summit we had the release of a new executive order, signing of a new executive sord order from the president which is focussed on the information sharing organizations. We used information sharing and analysis organizations which iss taken directly from the Homeland Security act. We use that term because it is the broadest set of organizations out there. A lot of times in the past theres been focus on information sharing Analysis Centers. We still support the idea. In fact those are information and sharing analysis organizations by definition. But information sharing and Analysis Centers happen to be sectorbased. So were talking about sharing across sectors also well. This would be regional sharing. Threatbased sharing. And other ways of coming up with new ways of sharing information not just tied directly to a sector. Now the sector work thats been going on for the past decade really has been instrumental in demonstrating how information can be shared and for building up the standards and best practices in the space. And its exactly that kind of work that we think needs to be needs to be put into a real standards private sector led consensus based standards body. Which is why weve proemtded this idea of the dhs granting new funds to a private sector body to stand up as the Standards Organization in this space. By the it will help to drive efforts in this way. The way the executive order does it is the completely Market Driven. We think that will be enough. Weve seen a number that want to start up but have trouble with the resource and understanding what they need to do. And we have having the best practices out there in a clear way will help from a Market Driven way. But weve also said in our legislative approach that if we can get bodies information sharing, organizations to self assert that they are following these body, we think that will also help to move this forward this area ford. And again were not talking about certification. I think there ease been some discussion of the certification. Were just saying that organizations would self assert they follow these practices. We think that will be enough to drive the marketplace today considering there is demand for information sharing and these new bodies to form. We think that light touch will help. And it is exactly this type of information sharing legislation that we would like to see move forward. We think it is essential that all of the efforts weve done to date we feel we are continuing to do what ke do in under existing law. But there are still barrier where we need legislation. We think we can have targeting liability relations. In a way that actively protects security and privacy through civilian channels which will allow us to do government oversight of our own work to make sure that were protecting the privacy and security of americans as we do this. There is we think that it is possible to get to that balance and we should do it in that way. And weve had good response from the private sector and stakeholders in moving this idea forward. Were open to further discussions with those stakeholders and with congress and we look forward to having that and i think hope we can have some of that debate today on this panel. [ applause ] hello everybody. Let me start by saying i want to thank u. S. Telecom once again for holding this event and this whole series of events. Really throughout the entire framework process. I think its been an invaluable use to the dialogue in this course. And i hope we have more. And like ari i hope we have one in may or something. That would be great. Probably a good point. Lets bring cris and david in. Can you speak a little bit to the state of information sharing going on right now and how the executive order is likely to effect the current environment . Chris do you want to start off with that . So within our sector, within the communication sector we already have an Organization Called the cons isac that meets regularly to facilitate information sharing. And also the individual telecos meet themselves on a routine basis to talk about Cyber Security. So i think there certainly is information sharing going on today. And there could be more. But in terms of how the executive order effects that i think it remains to be seen. The iso uconn september is interesting i think. And well see what happens over the next several months. My understanding is the existing i sacks will be views as the basis for the standards that will be used to develop the i sow. They participate in the process and provide leadership and examples of things they do, i think that will process will be effective and i think were optimistic at this point. Well see what happens. David . I also think that the communication Sector Companies have something to gain from the isow process. While they can control through contract some of the supply chain issue, if the isow process is acceptable they may want some of their vendors to participate as well to ensure that they are getting the best information as well to defend against Cyber Threats. I i i think one of the questions in addition to the very important question of Liability Protection is going to be whether the information sharing that is proposed in congress in that the president incorporated into the executive order meets the president s test. The president noted that the private sector needs to defend itself, government cant do that. But it also said that there needs to be a partnership. Because government often gets good and Important Information that the private sector does have that would be important to defense. So i think one of the questions that will determine the success of the sharing arrangements is whether business feels like it is not only providing information but getting good information back that makes it have greater success in defending against Cyber Threats. Theres been some view that that is a challenge that sometimes that kind of information hasnt been received. And i think the process with the ncic that ari outlined is designed to improve on that and deliver on the president s recognition of what is necessary. Ari how quickly do you think the private sector will see a tangible difference in the quality of information that it is getting from the government side . From the government side i think that over as i was saying over the last two years, i think we have heard that they are that Companies Already are seeing a difference in the amount of information. In terms of the quality of the information i think it depends how was we can get the ctic Cyber Threat Intelligence integrate center up and running. And also making sure that we can prioritize declassification or even keeping that information unclassified that that center will help with that as well. Depends how was question get that set up. The goal is very quickly to set it up. I think as with anything having do with organizing in the Intelligence Community there is a lot of questions how that is going to work and were wong working with congress on the details and want to make sure there is stronger understanding of that is we move forward. But i think people will see over a the next few months as that body gets stood up and we get people there and working that they will start to see quality of information improve as well as the amount of information. Chris. I just want to add i think the pointed david made and ari has been make are critical. The Mutual Exchange of information is a big incentive for companies to participate in the process. If it is a oneway information flow then companies arent going to see it as valuable as it is if its going both ways. Its also within the private sector i think there is the potential for there to be a lot of information conceptually if the isow takes off you can see a lot of information dumped on folks. And making sense out of that and putting context around it are really critical issues. So the Mutual Exchange and making the intelligence actionable will be where it provides value. This is also the importance of the move to automated information sharing. So much of the information sharing today relies on folks to take action themselves. Everyone wants to join an information sharing organization in order to get the information. But they are not thrilled about putting in there. If we automate it and say you are part of this. The information you are shea sharing, you will know exactly what information you are sharing. The information gets shared automatically out. You will see a lot more information out and there is a lot more certainty. I thinks we move to more automated you will get a lot more of that too. And in some ways the move for isow and having the policy overlay as weve built these technical standards that go underneath it will help make people feel more comfortable moving into the process. Where we get more information and there is more certainty around it. In the administrations legislative proposal you have structured the Liability Protection around the act of sharing with either the ncic or with the new isows. Why is it limited to those two entities. Isow is very broad. I think there is a viewpoint that in order to share you have to share with were not talking about the individual companies or a small number of the companies that could be isows but that is not true. The term means basically anyone sharing with one or more individuals. We want to page sure there is some rigger to who it is if you are getting this Liability Protection. In this case all you are doing is raising your hand and saying we are following under the Liability Protection in our draft you are just raising your hand saying were following these best processes that the industry has put forward but that there is something basic commitment to doing something in order to get the Liability Protections. And so that iss we want those based on the best practices there. When you are sharing with the government the reason we want it through a civilian portal and the reason the ncic is the place to do it we need to have some oversight. If were over writing all of the policy laws that exist in government today in order to make sure that information is being shared in a way that then can follow some guidance that is going to come in the future from the attorney general and the secretary of Homeland Security, the way to do that is to make sure it flows through a place. Then as david and others you know, can flow out to other parts of the government. But the key point there is that we have that kind of oversight that has on top of it to make sure that when it comes in that its actually cyber threat information and that privacy rules have been put in place. That confidentiality rules have been put in place that companies will want to see. We want to make sure that that is very clear and moves forward across the government. And the way to do that is to get the kind of oversight you cant have the kind of public oversight you need if that is happening in the Intelligence Community. How do the industry folks feel about that . Would you like a more expansive look at or a more expanseive arrangement in terms of who you can share with and know you get Liability Protection . I would say that is probably true. I think we appreciate the administration putting a the ploem on the table and, you know, weve been trying to get information sharing legislation passed several years now. And so the administration putting a the proposal out there is something that i think is helpful and something we can work them on going forward. But yes, i think that we are we do think the concept of tieing the Liability Protections back to the isow framework is limiting. I think the approach i would prefer is more akin to what, you know senators fine stein and the burr were working on in the Senate Select committee on intelligence and the approaches being taken in the house also. But i think overall this debate plays out over the next several months and we look forward to working with all sides and i think from at t perspective were mindful of the privacy concerns. And i i dont think were that far abart on issues. I think we can Work Together and hopefully come to some reasonable conclusion this year. We dont want to override any existing relationships. And we try to carve that out. And were open to ideas we just feel it needs to follow the basic framework. It needs to come dlu some kind of the civilian place primarily in order to make sure we have the oversight and privacy is being protected as this happens and that the Liability Protections are targeted to the sharing. Right . Yeah. If we can stay in that framework were happy there are lots of ways information can be shared. As long as we hit the key goals the nixadministration is going to be focused. Our is more private to private sharing side. I always viewed information sharing is three scenarios. Government to private private to government and private to private. So private to government, the issue is always should it go through a civilian agency or go through the intelligence agencies . And i think our view in the past has been the legislation that was proposed out of the Senate Last Year the previous verbs i guess. The 2014 version would have had that run through dhs and generally we were okay with that model. You know, as long as it didnt disrupt existing relationships where, you know, a lot of times our Companies Deal with entities like the fbis and the cijt if and other parts of government. So as long as the proposals allow existing relationships to continue. We would have been okay with that last year and supported that skbil this years is a little different but i think still the same path. I think when it comes to private to private, we think forcing everybody to be an isow might be too limited bull wiit well see how it plays out over timeout. Maybe as the non issue. But well see how it plays out for the rest of the year. I would just add that one thing that we also have to be mindful of in setting the criteria to get Liability Protection is the differences between big businesses on the one hand and small and medium sized businesses on the other. The extent database to the extent we want this to be real time we want to take a count of what their capabilities are of managing information stripping out information that may raise privacy issues. And we need the make sure that we require privacy to be a principle consideration and protected. But we also have to make sure that some inadvertent breech from trying to share in a timely fashion and depending on what the information is doesnt result in capital punishment. Right. I want to get into the question of the role of the regulator. But while we are here and were talk about privacy, ari i thought it would be really helpful if you could describe how the different pieces of the administrations privacy proposals fit together. There is the nist privacy engineering effort, the private element this is the information sharing legislation proposal and there is the Consumer Privacy bill of rights. There are three distinct legislative initiatives there that all have privacy at their heart as policies. Can you say how those fit together . And does this all add up to a uniform approach to the issue . So its were actually talking about a few different types of privacy there in the details. So in the information sharing proposal, we are talking about we have a definition of cyber threat information sharing. And that definition is a limited set of information that is tied to certain kinds of Cyber Threats. When that information and has limited uses when it comes inside the government. But when you share that information, then you have this broad ability to share that information, knot withstanding any other provision of law. So you are overriding a panoply of existing privacy protections in place and replacing it with guidance that is outlined in the legislation. But really still to be written into the future. So we are talking about kind of and most of that guidance is for Government Agencies. It is how Government Agencies will use that information. So were giving companies the ability to share that information into the government or share it amongst themselves with a set of new privacy protections that we hope will be strong. Private sector will write its own through the process of creating the information sharing Organization Standards and sharing with the government will happen through the guidance from the attorney general and the secretary of Homeland Security. So you have this kind of new regime that will come into play for that small type of information. That type of information is excluded from the consumer bill of rights. In our draft there is an actual exclusion directly for the same definition of cyber threat information in there. Because that already has its own regime through this other proposal that we have. And the hope is that that you have cyber threat information sharing in place with this kind of definition and then you would have this exclusion when Consumer Privacy bill of rights went through. The Consumer Privacy bill of right is focused on the privacy irks s issues that we see with new types of online and Electronic Commerce issues that come up. Where information is shared across each other. Because in the United States we have an industrybased privacy regimes. We have a lot of holes that pop up. You dont really have the kind of basic safety net that would be in place to protect information across all the those will remain in place and the Consumer Privacy bill of rights builds a safety nest for those areas that dont have privacy protections today. So this would be exempted from it. And the third is the nist privacy engineering effort and that is focused on Government Agencies and other stakeholders have seen that that when new products are being built privacy has come in afterwards. And theres been this question of how do we think about building privacy in from a voluntary consensusbased approach. Looking at the risks involved and looking at the kind of benefits that could come if we made the decisions earlier in the process. And nist is working to work on an engineering voluntary, completely voluntary effort to be used to make these decisions help. Government agencies make these decisions easier. And you would hope Companies Might look at that too and they could learn as well. But its really focused on kind of looking at these efforts in a way that relates to building new technologies and looking at how to go about doing that. Thank you. Before we move onto the regulatory piece. While we are on information sharing. I want to make one ore comment. A lot of people talk about information sharing in the legislation as being the thing that were trying to achieve through the slejs but it become a term that encompasses a lot of issue. The one thing i dont want lost is why do Companies Like ours and others support the information sharing legislation . And part of it is because today when we try to stop a cyber threat it require ours lawyers to be heavily involved in analyzing a variety of statutes. And determining what we can do. So a big aspect of the information sharing bill that is not talked about as much is the actual authorizations component of the legislation. So specifically, authorizations for companies to do things like monitor their networks or take actions to stop the attacks or i think in the last panel brine asked the question about Liability Protection, that if you dont act on a threat. Those are critical aspects because to us that would provide a clear Legal Framework, notwithstanding Legal Framework itself but under more clear which we can act and apply to Cyber Security. And i i dont want that lost. A lot of the reason we have been supportive of this type of lengths is because it clears up that legal overhang and allows us to act more independently in addition to the information sharing proponent. And we appreciate all proposals and i think one area they could improve is on the authorizations piece. That is a piece that without that, just having information sharing by itself and probably not going to be a really move the needle on security in my opinion. Charlie i would just add in addition to having been bureau chief for Public Safety and Homeland Security at the fcc, i also am a former Deputy Assistant attorney general for antitrust. So ived the chance to look at information sharing regimes in other industries and other circumstances and its clear that it makes a difference in terms of lowering costs and improving performance. And that is true if you look at the Insurance Industry and its important sharing of past loss information and the like. And that is going to be true i think in connection with Cyber Security. To raise the cost of conducting successful breeches for the bad guys and lower the cost of defense. And on the privacy point i think the senator was absolutely correct when he says that we all need to care about both of these issues. Because with the threats out there and the breeches weve seen, improved Cyber Security improved Data Protection means enhanced privacy as well, done correctly. Great. Lets talk about regulators here. [ laughter ] do we have to . Sure. The fcc charged a new working group about a year ago with coming up with a new paradigm around Cyber Security. And i know you chris and david have been closely involved in this. The final draft report has been completed. I guess tell us what is a new paradigm around Cyber Security. What is the goal here and whats boon accomplished . What is the state of play within the fccs working group. Let me set the stage naar, if you will for that. Im not on the working group and it hasnt publicly been released. The advisory committee. Which is called the csric. I hate to use the knack anymorera anymores. And then this working group four which was going to flush it out and give it meaning specifically for the Telecom Industry was going to be active and spend the next year trying to develop a report. Issue information that would make it applicable and usable in positive ways by the communication sector. And they have had more than a hundred people involved in a very intensive effort. And i think that were going to see a report that moves the needle and helps establish the Telecom Industry has one of the leaders in making use of the nist framework in trying to make it usable by small and medium sized businesses as well as the largest businesses. I havent read it so i cant comment on, you know, its outcome. But i think its been a very positive process and it is going to move the needle. I can give a few highlights as how the working group as doempb the last year. I know roberts here. He used to chair the working group. I chaired the wire line group. The way its structure is we had five subgroups or each major segment of the telecommunications sector. We had a wire line working group. A wireless. A cable satellite and broadcast. Five subgroups or each segment and also five feeder groups including things like threats. And metrics and the measurements feeder group im actually chaired. And we had ten different groups working on over a hundred members. And weve been working for the last year can the report issued in march will be a 300 page report. Goes through a lot of detail in various practices. We generally try do and i dont want to go into a lo lot of detail because its not officially released. A lot of what we tried to do is conform the framework and prioritize the nist framework for infrastructure. How do we secure Critical Infrastructure. If you look at the Communications Network and understand it is interdependency or other things Like Financial Services and electricity and water and others. How do we secure that and in the vent of the large scape attack that that continues to secure and function. How do we reform the framework and address it for those issues. That was the big focus and i think like i said we spent the last year working on that and i i this people my view that the work products is a true example how our sector partnered with the commission and others in the group to generate what is a solid work product and set the framework going forward. We have an question from our online audience. Its directed at you mr. Toretski. As isps shift to title two, will the cpni requirements make information sharing impossible . First of all i havent seen the text of the Net Neutrality order. I think it isnt out yet. It certainly wasnt a day or so ago. So ill refrain from give judgment on that. But one of the things that is in play everywhere from the federal court where is the linden case was argued this week and the federal trade commissions jurisdiction to enforce under section five of the federal trade Commission Act privacy and data breech reasonableabilityility standards is the subject of some uncertainty and some tech. And the sec to where in october they did thinker ferris major data breech case. The uncertainty from the rules and also the legislation thats been proposed i think in some cases delegates to the federal trade commission much more clearly. And some of the legislation i think would remove from the federal Communications Commission some of its enforcement. So what were seeing i think is a lot of uncertainty around what the standards are, whose enforcing them. And how they apply. And i think we just need to take a look at what comes out of the fcc on the Net Neutrality order before we draw any conclusions about it. I am pretty sure that the sec is going to want to make sure that information sharing isnt inhibited. I think the kind of information we are talking about sharing is you know, not at the core of what cpni is necessarily trying to protect against. And i think ill leave it there. Any other questions . Another one online. We have a second question for ari, how do you see this Government Private Industry Partnership improving the reliability of the electric system our utilities and power company, are they getting on board . Weve had a really Good Relationship with the electric sector in particular. That they have been very supportive of the Cyber Security framework. They have done a lot of effort in this space. Weve had and our plan is to work even more closely with them moving forward in terms of Incident Response and trying to make sure that they are getting the information that they need to be able to respond very quickly, the information that we have from the government and in sharing among themselves in order to get information in terms of the moving the response more quickly. Obviously there are a lot of different people in the energy space. And a lot of Different Companies in that space. I think we it is not an easy thing to say you are working with energy together. But if you can work sector by sector and certainly starting with the electric sector makes sense to us and move through those and come up and make surerersure inging ingcoordinating and getting the information we need. In terms that they also have existing information sharing and Analysis Centers today to try and chair information electrics is the electric isec has been growing and has been becoming more effective. Oil and natural gas has been growing and becoming more effective. We hope that we can help to make those moving more quickly as we move the isow process forward. Great. Well listen, i really want to thank this panel. That was terrific. Thank you all for your contributions. Okay. Well ask our next group of panelists and speakers to come up plus. Ease. Very good. That was an excellent panel and i think you heard ari talk about the seminal nature of the nist framework. And i think were very fortunate to have the participants we have today on the panel. Adam sedgwick i will now go into the future referring to him as one of the architects of the Rosetta Stone. Or discoverer. I dont know. But that is quite an accomplishment. Also Larry Clinton who many of you know as president of the Internet Security alliance and someone whos been an outstanding advocate around the framework for quite some time. Brian finch is a partner with pillsberry pillsbury winthrop. A lot of experience in the policy arena. And kevin morley for the American Water works association, which is one of the lifeline Critical Infrastructure sectors, very much involved in thinking about the framework as it relates to his sector. And then finally very happy to have jesse ward with us whose the industry and policy analysis manager with ntca of the royal broadband association. Jesse is also one of the leaders on the working group for effort that dealt with addressing small and Medium Businesses. With that id like to introduce david perera whose with im sorry. Im ahead of myself. Im going to introduce adam who will speak and then well have the Panel Moderator by david. Thanks. Im eager to move to the panel too. Ill get through these quickly so we can have discussion. Thanks again for u. S. Telecom for having me. These events are really helpful for us in terms of hearing what industries are thinking about, particularly Telecom Sector. But we certainly have representatives from a number of sectors here in the audience so it is very helpful for us. I was thinking about this event and the title of it which is on gaining traction or falling behind. And so i was thinking about it. And i actually wanted to go back and look at some of the things we were saying you could go many years but i chose back two years ago around when we were initially kicking off the work under the executive order to develop the Rosetta Stone or the Cyber Security framework. And coincidentally i found there was testimony we gave or my boss at the time game Pat Gallagher gave before the commerce and Homeland Security committees on what we intended to with the framework. And that was almost exactly two years ago. March 7, 2013. So i gave that a quick look to really try to understand what we had done and if we were hitting some marks and some expectations that wed set up then. And it was helpful to look at this and to think about some of the language that we were using then how the approach had been developed and if we were hitting the marks of the expectations on this part of the executive order. One thing we had in this was a heading called why this approach . Because we at the time we had to do a lot of work to convince people this was an approach that would have impact. And he said this multistakeholder approach leverage it is the respective strengths of the public and private. And helps in which both sides will be invested. Facilitates industry coming together to offer and develop solutionings that the private sector is best positioned to embrace embrace. So two years later i think we are seeing a lot of evidence how industry and government can come together to help develop those solutions. Not only through the process that we did in developing the framework, that yearlong process, where we had engagement from industry. We estimated around 3,000 participants. But even through groups like sric. The Communications Security reeblt and inoperability council. And that got into coming out in about two weeks we think will really help provide guidance to the Telecom Sector to really think about meaningful implementation guidance to a sector that is not only critical but broad and diverse and very unique in this space. We were really pleased that we could participate with csric. Donna dodson our chief visor there and throughout the process we were really happy to contribute our thoughts about what could how the industryled group could develop thesis products. And so in addition to work like that work like the csric for that sector and weve seen other sectors come together. Kevin is here to talk about some things the water sector has done but certainly weve seen the electric sector and the Financial Sector come together to provide guidance. Weve also seen a lot of other examples back in what director gallagher was talking about with industry coming together to offer and develop solutions. So weve Seen Technology companies coming together to talk about products and services that could be aligned with the framework. Weve seen the auditing inging inging community thinking about the auditing standard they could provide. And insurance providers have begun to officer offer policies tied to the framework in promoting among policy holders. And weve seen states leveraging the framework to improve security of their infrastructure. Including in many cases as a foundation for their work in Cyber Security for state of Emergency Management agencies. These are all things we are seeing out there that we didnt help catalyze, capture and share back. And a lot of this material was discussed quite a bit at the forum last month that the president was at in stanford. Where a panel of ceos discussed these initiatives. In terms of what that means for us and how we at nist think we can help and our work for the on going year and plus i hope we can get good feedback on this panel. Were going to continue our efforts to going to continue to raise awareness on the framework including by working with other organizations including associations like u. S. Telecome and others here today. Also thinking of the international audience. One of the Top Priorities will be to develop and share training materials that can advance the use of the frame work and other management purposes. Like how theyre using and employing the framework and the ability to look over each others shoulder to understand the practices theyre putting into our view and extremely beneficial. And how it can be aligned with business processes including the really key challenge and key issue of making sure that we can integrate cybersecurity Risk Management with the broader way that these associations think about risk. That is something they think is very important. And in addition to that if you think about what the framework effort was all about, identifying the best practices standards, and guideline to use through Critical Infrastructure it was making them used more widely through the framework. We talked about what we called the roadmap, the list of priority projects from supply chain Risk Management, technical privacy standards they continue to work on and share information back on the progress that were seeing with the hope that in the future as this continues to be a living document through the experiences and through the projects it can have a richer conversation about what are the priorities moving forward to keep this truly able to react to the priorities of the people that need to manage signer security risk. In all of these efforts it will be a priority for us to be sure it can be conducted in the same open and collaborative manner in which the framework was developed. I think going to the title of the event are we gaining tractions or moving behind, there is a lot of work to do about is there any effort based on the advice we have gotten from the private sector our immediate focus has been to continue to raise awareness our stakeholders have told us that more needs to be done, and a lot of that is raising awareness with sectors that dont have regular events on Cyber Security. Thinking about that is the e eventual first step. We have seen efforts like this to improve quality in other fields. There is no single definitive and universal end point for aimproving quality or Cyber Security. We recommend they do a serious evaluation of their Cyber Security practices and develop plans to improve their capabilities ideally through the use of their framework or other management tool. Because the framework is voluntary, it allows us flexibility to continue to increase the number of stake stakeholders that with can work with. I realized that the people across the aisle from me were talking about putting framework in their infrastructure. The private sector has voluntarily participated actively in the development process. And we have found that they are more than willing to discuss how theyre using the framework and ensuring lessons learned. We intend to work with our Partner Agencies across government on their sector wide assessments, monitor their surveys and understand how we can leverage those and then continue to receive information through the workshops meetings and future rfis that we tend to have meetings like this. And all of that information were thinking about what can we glean today to help our stakeholders and eventually improve future versions of the framework. With that i will close my remarks. Im looking forward to this discussion, hopefully that helps provide a foundation. I thank robert and ustelecom again for having me. Hi, im dave a Cyber Security reporter with politico. I will be your moderator. We have a great panel. We all agreed in advance that we will be direct and to the point. So lets get to a first question. Lets talk about the Cyber Security frame work scope. We have two utilities on the panel. Perhaps both of you could address do you envision this as something applied just to your core infrastructure, how would you define that, what about the enterprise i. T. Systems that you also control . So the framework has applicable beyond infrastructure. Infrastructure as defined in the order, a narrow definition. So what we have tried to do is really thread the needle. As robert mentions i coled with susan joseph, the small and medium size working business group. And were looking at small and Medium Business issues. And what we saw is that although s m, small and mid sized businesses may not fall in that definition, that doesnt mean they cant adhere to the same spirit of this assignment. They can keep the scope the same but appropriately scale it for their operations. So we were looking at having each small and mid sized business define for themselves poor and Critical Infrastructure. So for small and rule telecommunications companies, it may be that one of those companies defines their switch as core infrastructure. Without that there would not be communications taking place within that local area. So i think there is applicable for our customers the e. O. Defines the frame work. I would also say that what we looked at. The sister working group im sorry, is that the framework also has applicability at the corporate level. Every Company Wants to be more secure, right . As much as they can look at that it seemed to be helpful. Out of a fear that that might, as i understand it, give the ntc additional leeway in regulating what it doesnt regulate. From our perspective again, if youre a company with ten employees, you have extremely limited resources. You have one perhaps technical officer who is the where should he prioritize that . But all of the associations the Network Operators on there agreed this is a Good Business practice. So if they can, it should be applied at the enterprise level. So if i could add so that, we have embarked on this process a little bit before and we have been anticipating the need for the sector base and we run the gam gammet from small communities. And we had to be cognizant of the scale. There has been a lot of activity of folks going around some of the Business Enterprise systems, and there has been less talk in the past on process control systems, or city yal control systems. We developed a process to make it more transactional for our members. A lot of them dont have cios, right . So putting it into term nol of how they prioritized the technology, where should they focus their time and efforts . So we created a priorityization cool to help them work through the application of the principals and the frame work to try to change that behavior and institutionalize is as i think we have heard from so many other speakers today. So i think the answer is yes. Yes. So that plays other to the enterprise system as well. Are we changing the name for the Critical Infrastructure any time soon . Well so i think you posed your question in terms of how do companies evaluate their infrastructure within the entities and can it be used more prodly. And that is one of the decisions we had in the development of the frame work. Different entities view it very differently. Some will treat how they deliver Critical Services others take more of an enterprise wide view and leverage it that way. People do it in different ways, you could set up a serious of profiles in your organization and were seeing people using ittinging large to small organizations been the information that we have received are getting more utility from the broader application where you can look across your entire enterprise and that is the sort of thing that awe diting and insurance also like to see. They like to see that youre managing all of your risks for all of your networks. In terms of others using the frame work even though it was developed by Critical Infrastructure, you look back to our first rfi we said that given we used the term generally organizations. One of the reasons we did that is we had an expectation that Critical Infrastructure also evolves as i Services Change and they move up and down in the marketplace. S and we thought about doing this in a way that could be broadly used and now were excited that it is being used by organizations that may not traditionally be cured Critical Infrastructure. Lets get other folks involvemented. Larry, you talked a lot about the need for the federal government to follow through on a portion of the executive order. One thing that Officials Say a lot of is that the framework is infinitely plexble because every company is a special snowflake. And what constitutes Cost Effectiveness must vary company to company, but there can be no federal government Cost Effectiveness standard or guide or what have you. I think the reality is that if youre twoing to have as valueen tear system, it will have to be Cost Effective. There is no other way to deal with this. This is what every single study that looked at signer security tends to find. Csi, Price Waterhouse coopers, cio magazine the list goes on and on and on. The Companies Make decisions based on Cost Effectiveness. And one modification i might make building off one of adams comments, how that risk is true, but really closer to what senator johnson said at the very beginning. We need to integrate the missed framework and other security steps into profitability. Into growth. Into innovation. These are all one in the same things. Now as to whether or not we can offer any guidance on this this is what we do with everything we do in the private sector now. Companies look at environmental regulation, or activity or disabled regulation or activity, and they make a Cost Effectiveness asseration. And so we will have to do this. My guess is we could come up with some fairly useful guidance because frankly electric utilities dont look much like i. T. Companies. Defense companies dont look very much like some other manufacturing companies, et cetera. I think we could do some useful studies, and we have proposed that this be done in a collaborative fashion integrated the sector agencies with the Sector Coordinating Councils to jointly come up with a mechanism, and we can determine what would be the most Cost Effective way to implement the framework in their sectors. And with have done further and found that various a sizes of companies, even within the category of Small Businesses find Different Things to be Cost Effective. We have looked at companies with one security personnel such as jesse was pointing out. And we found there is certain things that can be done in that Small Company that are Cost Effective and not the same thing as if you have ten security people. The reality is that if were going to get truly broad based voluntary adoption in this framework, were going to have to address this at the economic level and integrate this into our economy which is growth innovation, profitability all tied together. Guidance by sector and by size. Those are two ways that we could subdivide these things. Im sure there are lots of others, but im happy to start with those. So individual companies are not as special as they like to think . Well we are all individually special, but every single one of us probably does well if we exercise watch our diet things that are Health Effective for us, Cost Effective for us. Were allel probably pretty good. If we study and do our homework as students et cetera, et cetera. I think there are best practices that can be applyied and i think that is probably true. I would like to note that i am morally opposed to exercise, dieting, studying and doing my homework. Live long to 42. It is very interesting building on larrys comments i think it is an excellent representation about how companies can begin to start to think about Cyber Security. I think the number of people dedicates to Cyber Security is misleading and focusing on that in terms of how useful the framework will be. Youre all being breached at any given moment its about recovering and managing that risk as much as anything. And in my mind, looking at the political infrastructure, i done think the framework is a big surprise or innovative for the larger communities. It is not in any way shape or form to denigrate the great work they have done. I think they have done a great job for the smaller and medium size businesses and they have nowhere to start when it comes to Cyber Security. And so i would like to look at a frame work from that perspective. The other thing that is important too is a lot of times when people talk about we adopted the framework, we fully integrated it into our systems and we will see comments from media and lawyers saying if we dont when determining liability when it comes to cyber risks. I just dont think that is the case. I dont think the framework represents a standard of care. Are those lawyers charlitans . No, i think it is a fundamental misunderstanding about the frameworks intents and purposes. It is like a golf swing i can watch a old video of tiger woods as many times as i want and try to mimic it but i will never get it right and i will never pound it 340 yards down the fairway. That usually takes me three shots, so were talking about spending for further Critical Infrastructure, we have to understand it is one piece of the puzzle just like inform sharing. Were talking about threat signatures or indicators of compromise et cetera. That is all well and good, but it will not it is only about how you execute at the end of the day, and the framework will be helpful in some context and it comes down to how does that company supplement, thats where the rubber meets the road. So this brings up a question of how do we measure that. Because the framework is individually implemented a universal set of implements could measure the wrong thing, but we heard that sectors have commonalities. Business horizontals like size, have commonalities. There is Common Ground for some kind of measurement, isnt there . Adam . Well, im going to take this opportunity, you said to keep our responses brief. One of the things we recently put up was a frequently asked question, a very legitimaty one. Other questions for future forums. So let me read the response here. Can we measure the effectiveness of a framework . Is the organization saeking a overall assessment of cybersecurity related risk, is it seeking a specific outcome like better management of Cyber Security with the suppliers or greater competence in its assurance to customers. Varies per use in a circumstance. Individual entities may develop dwaun daytive metrics for use within that organization or its Business Partners but there is no model for measuring specific use. That is where we are. That is our overall thought on the issue. We can certainly study and dust with our partners to think about what common measurements and metrics are. That is something were very interested in seeing. We have Risk Management tools rather than the steps they put in place to evaluate and measure that theyre do the right things. Lets go down the line. I just want to jump in quickly to agree again as i usually do with my close friend adam on issues like this. And i think that is exactly right. Not only can these things be measured following the outline that adam just laid out, they will be issued. Every single corporate directors, focus on the framework, endorse them in the publication, every sing one of the corporate boards comes to these important decisions and they want to operate based on a metrics. Can a individual company come up with their own goals and determine their measure for achieving those goals . Of course, that is what every company does with virtually every single business decision they make. Where should we open a new store . Where should we launch . All of these things are looked at carefully, measured and measured in terms of effectiveness and their cost. And unless we integrate both of these as im telling you the companies will, then we will miss the boat. What im saying is that we could do a substantial solid, a favor for our private Sector Companies if we gave them some samples that we could work from. If we said we did a study of small water systems, and we found out that this set of best practices was most Cost Effective and this one was not, people look at that. People now know where they can go to implement the tramwork in a place that will most likely benefit them and they will make adjustments. Thats how we integrate the flexibility of the framework one of the major pluses with the inherent obligations of businesses that are charged with maximizing shareholder value. We have dual stresses here security and profitability. We must integrate them. And as i mentioned, that is very difficult in the digital age. Things that duo to drive innovation and productivity under mind securities. Again, so kind of playing off of the points that adam made, on the individual nature and the flexion ability, the frame work and the opportunity it provides, and entities and companies, telecoms so provide the practices, and in the studies that we have done with our members, looking at their potential, there is a significant amount of variability in the types of things that i do, and the controls applicable, maybe only have of them because of the way they operated, so the collection of that data outside becomes kind of apples and oranges. There is no way to come up with a measurement . So here is the question. The question is, right, what are we trying to measure . Are we trying to measure that i tie my shoes and put my shirt on left hand or right hand first . Or is what is important that the entities are taking the appropriate Risk Management activities through application of the principals in the framework that are laid out in the guidance that we have designed to help utilities apply in this framework. So there is different measures of activity whether it is process related. I think that is good, a individual entity, that is how they can do their internal benchmark benchmarking. But were seeing a chance of how it is integrated into the Business Practices and that is through some form of an option, to use that term loosely, of the frame work. That is how we approached it in our center. I agree with what kevin said, youre looking at anlevel of is it better at securing, making sure the network is still available, when you look at a sub category of control, it doesnt, what one company does compared to another might be very different. For instance if youre a small rural telco serving defense contractors the security you need is very different from a small rural telco in Middle America that has different customers, institutions, and needs opinion i think were having a discussion about metrics, but the framework in dc circles, we have talked about the framework for years but when you talk about framework, it is still a real uncommon concept out of the beltway. I used the term n. I. S. T. , and i had to define that for the audience. What we really need to focus on is awareness and education. From our perspective our members are 900 rural telcos across the u. S. And they all want to be more security, right . They want to protect their core network, their customers data and information. It is a question of assisting them with doing that more efficiently and effectively. So we were talking about metrics with reference to the framework. Every company has a Corporate Risk manager. They dont have a Corporate Risk eliminator. You cant eliminate risk. And so then when you start applying the frame work at the individual corporate level, you have to utilize it. You need define the threats, the types of attacks that you can suffer, that you can protect against, you might be able to protect against, and those you cannot protect against. And that last bucket is data tap. Not even the federal government can withstand a nation state attack. In that fuzzle middle area, where it may be a nation state or organized crime, it is kind of a mix between incident respond and there is malware and individuals, itself. Ultimately again, it is individual Companies Looking at their risk and how theyre appropriately protecting themselves. Are they trying to stop it or minimize what is associated with the cyber attack. And one thing is an article that you read, david, a month or so ago that were dancing around a little bit here about some of the responsibilities of the Software Companies as well. You read an article about google, and a certain time frame they have come to discover. That is an important point to remember as well. As much as the companies can do to protect themselves perimeter defense or response, there is lots of moving parts here. Part of that front is a lot of Times Companies are receiving, utilizing vulnerabilities, and this is a shared burden throughout the and entire supply chain, and you have to look at that whole picture before you get closer to managing the risk. Other questions . Chris . More of a comment than a question. I wanted to see whoaat the comments are about metric thats are going around. I think it should be focused on education and awareness especially in the belt way. One thing that frustrates me is that people focus on how are you measuring the framework. The real question ought to be what is the framework that is provided. It should be focused on outcomes not activities. We were all busy this year, but that is not a outcome. The fact that were using the frame work, that companies are using it is almost irrelevant to whether or not it is an effective tool and thats why with the working group, we focus so heavily on things like integrity and how quickly we can recover from attacks. And we go about response activities because those are things you can measure. As opposed to just we have a question from the online audience here. And anyone can jump in. Considering the vast amount of devastating breaches that have occurs and are known and also taking into consideration the breaches not publicized how comfort are you that the awareness and use in the public and private sector will help reduce the number of incidents in the future . Well, so on the awareness front, i would agree with our colleagues that that still continues to be a priority in making sure to jesses point that we communicate to people what were working on here why it matters to them, how its voluntary, how to use it. In terms of the other part of the question, in terms of minimizing incidents one of the things we talk about quite a bit is there are those unknown unknowns that companies will not be able to prepare for. The reason we talk about Risk Management and resiliency is in some ways were trying to have folks understand that you cant prevent every incident from occurring, and the reason why we had those five functions, and we talk so much about respond and recover, is that we think from the Security Community there is a wide understanding that you cant prevent incidents, but it has not always made its way to Corporate Leaders and policy makers. So recovering from an incident. We also see are critically important. And then i think to the point of the question, if you go back to aris presentation earlier in the day, this is one element of many going on that the industry is under taking that the federal government state government, National Governments are under taking to help manage this problem and we think, together we hope that obviously it will have the approach of making things better out there. David if i could just build on adams comments, and i agree with them, and particularly the last one about how many things we are dealing with here, and in, you know, thinking about the title of the event as to whether were gaining traction or losing ground, i think we are both gaining traction and we are losing ground. The u problem is so complicated. And the bad guys have all of the advantages. It is cheap easy, profitable, there is no return on investment, and virtually no law enforcement. And with jesses comment about having to go outside of the beltway on the community and do more awareness and communication, that is so true. These past weeks, mr. Clapper said that Cyber Security is a bigger threat to our nation than international terrorism. And i think that is probably true. But the spending in our government, which by the way does get it and is expert, is about ten times more we need more funding more effort, more investment, and more thinking about this or we will continue to fall behind. A couple comments, i mostly disagree with the panel on metices, chris aagree with dwlu it is measuring outcomes. With the frame work being roe set ta stone, it Rosetta Stone even though they do it differently, and if you want to know how there is one measurement that everyone ought to be measuring which is good, how do they respond, how fast do they respond and do they to the priority indicators and security breach. Because they dont. Because of the people that prioritize most breaches there are indicators of compromise. Target had two times they could have prevented it. There are indicators. We miss them and it goes back to what mr. Finch said. Process control management. Cybersecurity is great i hate to do this, but for time do you have a question . Thank you very much, come talk to me about how to measure it. Thanks. Ill just respond to the comment. I think there is one point that i would make. If you think about a lot of our efforts, it is about reducing complexity. The goal of getting these things out there is not to add more guidance, to add more paper for people to go through, but to help make these conversations a little easier because we all understand where were coming from. That is the role of standards. That is why we think a lot of these efforts are really important. Thats one of the things we think will be really important in the long run in terms of reducing costs. We think we can have a much richer conversation. Please join me. [ applause ] im going to say thank you all for attending in person and acknowledging all of the folks who attended via live stream. I will want to thank all of the panelists who were involved today. I thought it was very excellent and informative set of panels and discussions. And i want to also announce that we will have a, you heard a lot today about the work of working group four that will be released on march 18th. On march 19th u. S. Telecom will have another forum to talk about that event. Look for that on our website. Well be pushing that information out as well. Thank you and have a great day. President obama said today that the United States will stay rather than reduce its current level of 9800 troops in afghanistan through the end of the year. It was announced at a joint press conference with afghan president ghani who met with him at the white house today. In support of todays narrow missions we have just under 10,000 troops there. Last year aannounced a time line for growing down our forces further, and i made it clear that were determine today retain the gains our troops have drawn. I consulted with general camp bell in afghanistan and i decided that we will maintain our current posture of 9800 troops through the end of this year. The specific trajectory of the 2016 draw down will be established later this year to our final consolidation to a embassy presence by the end of 2016. This flexibility reflects our partnership with afghanistan which is aimed at making afghanistan secure and preventing them from using it to launch terrorist attacked. Reconciliation and settlement makes it the best way to safe Guard International interests peace, as well as security interests. Second, and the best way to ensure it is a political sentiment, were going to support an afghan led reconciliation process. President ghani you have shown great leadership. Afghanistan and the United States agree on what the we must do. Abide by afghan laws including the protections for women and minorities. Third, well continue to support the National Unity government in their efforts to truly serve the afghan people. See president obamas First Press Conference tonight at 8 00 p. M. Eastern. Or log on to our Video Library any time at cspan. Org. Here are some of our featured programs for this program on the cspan networks. On cspans twos book tv, Peter Wallison says that Government Policies caused the financial crisis and that it could happen again, and director of the Earth Institute at Columbia University on a plan to target global issues, and saturday morning at 10 30 eastern on American History tv a discussion on the last major speeches of Abraham Lincoln and Martin Luther king jr. And the 1965 meet the press interview with Martin Luther king junior. Find our schedule at cspan. Org. Call us, email us or send us a tweet. Join the cspan conversation. Like us on facebook and follow us on twitter. Next a Supreme Court justices Anthony Kennedy and steven brier testify on the courts 2016 budget. The question is for just over 78 million. A increase of about 1 from last year. They say they will use funding for a new Electronic Filing system that would be able to track petitions. This is an hour and 20 minutes. This hearing will come to order. First of all, let me welcome justice brier and Justice Kennedy. We appreciate you coming back and being with us here again today. We all look forward to this time to have an exchange not often does the legislative branch and the Judicial Branch get to talk to each other. So we look forward to that. I think all of us know that a fair and impartial judiciary is a corner stone to our democratic system of government. The fact that youre here today i think is important. I think the work that you do is obviously very, very important. And not only you resolve disputes between individuals, but also between executive branch, federal government, and legislative branch. And to do that you need the respect of the citizens and i think you have that. I think you also give respect to the citizens with regard to what is right and what is fair. Today is important because we have a chance to talk to each other about issues that are important. One of the things that i want to comment you for is your work to try to help save money. Everybody knows that the government needs money to provide services. But of late we are trying to make sure that every task of government is completed more efficiently and more effectively than it has been before. Money is limited. And you are to be commended for the work that you have done to try to save the taxpayers dollars. I notice that your request this year 88. 2 is almost a million less than you requested last year, and i can tell you, fellow members up here dont see that happen very often when an agency comes in and asks for less money than they received the year before. We thank you for that. I know you done some Cost Containment initiatives dealing with technology and personnel and it has paid off. I flow isknow there is small increases that are inflationary themselves. So we look forward to hearing from you about the resources that you need and any other comments you might have about the judiciary . General and we will pledge to you to work the best we can to make sure you have the resources necessary to carry out your constitutional responsibility. Once again, thank you for the work you have done to try to save money and be efficient and effective. In closing, let me say on a personal note im from Jacksonville Florida and we have the chester bidel end of the court. And every year they have a special occasion on law day. They will be requesting one of the members of the Supreme Court to come in 2016 to be there for that celebration in Jacksonville Florida. I hope you will be on the lookout for that invitation. They would love to have you there and i would be honored to introduce you to jacksonville, florida. The chairman has no shame. And that hasnology to do with your budget request. We look forward to your testimony, but first let me turn to the active ranking member, mr. Bishop. Thank you, mr. Chairman. Ranking member sorano would have liked to be here today and he could not and he sends his apoll guy apologies. I would like to welcome you to our sub committee. This is a rare opportunity for our two branchs to interact. Because of this sometimes our questions range beyond appropriation issues. We look to you for insights on what affects the federal judiciary at a hole we have to be careful not to affect the ability to hear cases and dispense justice in a fair and timely manner. We have to be sure also that the Supreme Court is both the final authority of our constitution, and the most visible symbol of our system of justice with our sufficient resources to under take not just judicial functions, but Public Information functions as well. We look forward to your testimony. Welcome, and whatever we can do to make sure that we have a strong independent well funded judiciary, we want to do that. I yield back mr. Chairman. Thank you now let me recognize first Justice Kennedy for any remarks you might like to make. Well put your written statement in the record and if you could keep your remarks in the neighborhood of five minutes that will give us time for questions. The floor is yours. Thank you, mr. Chairman. Thank you for your welcome and your greeting. We bring our messages of greeting from our colleagues with us today. I was just going to order where they are seating, our jeff who is counsellor to the president , or counsellor to the chief justice and kevin cline, our budget and personnel director, and the marshall of the court and is patricia here . Cathy, our Public Information office. As you indicated mr. Chairman were always very careful, very cautious about budgetary expenditures. And the budget of the Supreme Court is just a small part of the budget for the courts as a whole. And the budget for the courts as a whole is a very small part of the United States budget. And i think today you will hear a presentation from judge Julia Gibbons from the sixth circuit. She does a marvelous job, and the budget for the federal judiciary as a whole is important, i think, for the congress to realize that it is not just judges, there is 7900 probation and presentencing. This keeps people on supervised release. It is very cost saving, and over the years in the federal system we have a very low resid vision rate for those on release. It is high if you look at it as onethird, but it is quite low compared to the state. This is comfortable effective. The federal courts as a whole, mr. Chairman, are a tangible palpable realization. And they see the judicial system and they admire it theyre inspired by it and they say you cant have a free Economic System without a functioning legal system so what you do is of immense importance. For our budget, overall, we have a decrease in our own Court Operations and expenditures. We have almost exactly 1 , a little over a 1 increase. And that is for mandated increases for inflation and salary increases that are mandated. Over half of that we have absorbed cost cutting in the courts. So we absorbed over half of the mandated increases in the frame work that we have. The court is planning to have in the year 2016, an Electronic Filing system so that all of the papers filed with the court will be on Electronic Filing. We waited until they could get on that system so we could then take it from there. But of course this also includes filings from state courts and from prisoners. We think this may require an increase in personnel by one or two people were not sure. The petitions of which theyre, i dont know, its in your chart, probably in the area of 6,000 a year, are usually handwritten. When this is put on electronic retrievable system you will have a database from which scholars and analysts can look at the whole system and make comparisons. How many what are the percentage of cases where there is a complaint that is search and seizure. This will be a data dais that will gift us considerable data so we can study our system. We are prepared to answer questions about the specifics, but we thank you for the honor of being here and justice brier and i are pleased to answer your questions. Mr. Brier youre recognized. I simply just reinforce what my colleague said. Youre here and thats a good thing, so are we. I think our problem is not necessarily the budget, but how do you get the American People to understand what their institutions are about . In our case were not up in some heaven somewhere where we decree things from on high. Were part of the United States. And youre interested in the income mechanics of how we bring this about. Trying to explain to people what we do. And you say were part of you and youre part of us. And that is talking to the people of the United States. So im glad to have even a little opportunity too talk about our institution and how it works, and im glad youre interested. Thank you very much mr. Chairman i just might Mention Court which you eluded to. Was the idea of former chief justice warn burger. He wanted to replicate this structure in which judges and attorneys and law professors and law students get together and talk about stuff and he did it with the late judge christianson. And it has been remarkable. It cost the government no money, and in california and boston, they have sendends of court, and it made a real visible difference in the civility that we have. That is grease because it is there to boost professionalism, and theyre doing certainly a great job. As were getting the questions, i cant help but recall the last time you were here i asked you how the Court Decides who they will sent over to testify before us, and i think you rely it is based on merit. So youre back again. Let me ask you one of the thingss that i know there has been a lot of work being done and in the last ten years i think this committee appropriated money and things were upgraded. So i just want today ask for a update on how that work is done, if the facade was redone, north and south is that all complete. At one time there was a big hole in the ground next door but since i have been back of late, everything looks really nice can you just five us a update on how that is being done. Is that being finished . The project for refurbishing of the building is completed. We came in under budget and the project has been closed and has been very, very successful. Incidentally, the original cost for that was, the original estimate was 170 million. And i talked with your predecessor when i got the message, and he said i think weve got a problem. It sounds too high to me. We hired our own architect. And worked with him. And in fact my recollection is he did most of this work pro bono. From the architect we hired, he was from the university of virginia, taught architecture there. We got it down to 120. And the billing came in under that. There were some contract claims. One of the problems was the windows. You look at our win des on the court. There are these lovely windows. They measured the bottom, the width of the window anded the height, they didnt know its not a rectangle its a trapezoid. Its brilliant architecture. So that was about a 15 million mistake. Which we werent going to pay for. Thats the kind of thing that comes up. And its it is finished. We had to replace all the wires, all the air conditioning. We had the air conditioning system from 1938. And when it broke, there was a fellow that was retired in west virginia, we sent a police car to get him we better fix this. Thats been a the facade is a different project. Thats the some of the marble was falling off time has not been kind to the marble on the building. And so were still in progress. The entrance, the west side of the building is done, but the North South East and west have yet to be done. Let me ask you, the whole security issue, the world seems to be getting more dangerous, whether its internationally, or domestically, and i know from time to time the Supreme Court hears controversial cases i know you spend about 18 million a year on security. I wanted to you to tell us, is that adequate . If you hear going to hear maybe a highly charged case, that you have to increase security during the time those hearings take place. Give us an overall view of how you see i was just speaking with the folks in the federal courthouse. Thats a concern to them. In these difficult Economic Times to make sure we have Adequate Security for a lot of people that are in public service. But give us a little update on how is that all being funded . Is that all being taken care of . It has been, a few years ago, we projected that we needed more than we ultimately asked for. Were satisfied that we have the right number. Yes, of course in high profile cases or when threat assessments are going up we have increased security. But we can do it all within our existing staff. Thank you. Mr. Bishop is recognized. Last year, we discussed the real impact of sequestration. Unfortunately, we still need to discuss that, i think most people think of grants and federal programs. As a way to dial back operations. Its not the case with the federal judiciary. The courts have a constitutional responsibility, and you cannot control the scope of your jurisdiction. And youve already undertaken strict costcutting measures prior to sequestration. I know you cant answer for the entire judiciary. What do you see as the continued effects of sequestration. What concerns do you have is sequestration is continued . I havent heard the testimony for other agencies. Were all unique, you cant have any sequester for us. I want to repeat the argument you hear all the time. Number one, we cant control our work load, its controlled by forces and factors that are behind our direction. Number two. We have a tradition, as the chairman indicated of being very prudent and very cautious. With us if there were cut backs, it would mean delay processing time of cases. And it could mean compromises in security. With the courts in general, its much more significant as we indicated, we have 7900 probation officers, and if theyre laid off. That means more people are in prison at a greater cost. The secret stayed and it works back backwards. At some point you cut back enough. You keep going youll discover that unfortunately in the United States there are crimes, and people ar rested. And they are supposed to be tried and you need a judge and you need a jury and you need a courtroom. And the alternative is not to have the trial. You dont have the trial the person has to be released iks and there we are. There is a minimum. And if you go toward that minimum and beyond it, you will deprive the country of the services that basically are needed to run the government of the United States in this area. Thank you. Your total fy 16 request buildings and grounds does represent a discretionary decrease of 1. 1 for fy 15. It looks like this is a combination of the construction work being completed and savings from nonrecurring costs associated with implementation of your new financial system. Are there program increases that youre delaying but you still feel would be beneficial at some point . And well regard to implementation of your new financial system, which i understand youre leveraging resources from the executive branch, the department of interior specifically in the area of payroll and financial tracking. And i understand this move has reduced your alliance on contract employees, and it seems to be a great step toward efficiency. Do you feel youre getting an improved level of service. Would you recommend this to other agencies that are looking to reduce that cost . Im not enough of an expert to recommend it to other agencies, but our staff tells us its working very very well. They like it. They like it better than the outside contractors and its much cheaper. We are in partnership with an agency, in the department of interior. Which has some similarities to us and its been the source of its generated most of the savings weve had over the last few years. Thank you mr. Chairman. Thank you. Congressman bishop the were not holding back on anything, other than we do have this projection that we may need two more people because of the Electronic Filings were going to put in place in 2016. I must remark, thank you very much mr. Chairman, the answers from our witnesses are so succinct and to the point. We dont. Not only do we not get people requesting less money, we dont get people that speak clearly and concisely. Corn grat u laces on both fronts. Now, id like to recognize mr. Womack. I wish they were all this way. Justices once again a great honor to have you before us. We always look forward to hearing your commentary. And specifically interested in the i. T. Piece of whats going on in the Supreme Court. These Technology Changes are happening so fast. So fast that we get further and further behind i think in trying to keep up with what technology ought to be able to do for us. And so i am interested in knowing just how well the i. T. Upgrades are going and listening to your testimony Justice Kennedy, i got to thinking about our friends over at va dod, theyre having such a difficult time coming up with a platform that can kind of serve a very special group of people to our country, our veterans, and being able to get these two systems to talk to one another. Do you encounter any of that kind of conflict within the judicial realm in dealing with matters of information technology. The guess is justice brirz is much more well versed in this than i am. My guess is that, by comparison with many other agencies, our problems are predictable. We know theres going to be a trial with the plaintiff and the department, we know theres going to be an appeal. We know there may be a petition with a petitioner and respondent. So the universe of problems is rather well known and rather predictable. We dont have to project for uncertainties to the extent nearly to the extent that other agencies do. And our system, the legal system lends itself very well to the electronic technology. In my own mind i classify three Different Things that technology can do. One you heard about and thats the budgeting for example, and things that are technological, they made advances in getting together with other agencies. The second which is coming along, is the ability to file briefs and